Npm packages with over 1b weekly downloads, incl. Chalk, have been compromised.